Alsa-Devel Archive on
 help / color / Atom feed
From: Takashi Iwai <>
Cc: Dan Carpenter <>
Subject: [alsa-devel] [PATCH] ALSA: usb-audio: Fix NULL dereference at parsing BADD
Date: Fri, 22 Nov 2019 12:28:40 +0100
Message-ID: <> (raw)

snd_usb_mixer_controls_badd() that parses UAC3 BADD profiles misses a
NULL check for the given interfaces.  When a malformed USB descriptor
is passed, this may lead to an Oops, as spotted by syzkaller.
Skip the iteration if the interface doesn't exist for avoiding the

Fixes: 17156f23e93c ("ALSA: usb: add UAC3 BADD profiles support")
Suggested-by: Dan Carpenter <>
Cc: <>
Signed-off-by: Takashi Iwai <>
 sound/usb/mixer.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 45eee5cc312e..6cd4ff09c5ee 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2930,6 +2930,9 @@ static int snd_usb_mixer_controls_badd(struct usb_mixer_interface *mixer,
 		iface = usb_ifnum_to_if(dev, intf);
+		if (!iface)
+			continue;
 		num = iface->num_altsetting;
 		if (num < 2)

Alsa-devel mailing list

                 reply index

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Alsa-Devel Archive on

Archives are clonable:
	git clone --mirror alsa-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 alsa-devel alsa-devel/ \
	public-inbox-index alsa-devel

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone